Ransomware Group intelligence
Wallstreet
ActiveTrack Wallstreet with 44 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Wallstreet is tracked by Breach House as a ransomware group with 44 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
44
- Leaked 28 63.6%
- Pending 15 34.1%
- Deleted 1 2.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | 4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion |
Top Activity Sectors (12)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Wallstreet, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Wallstreet leverages PowerShell to execute malicious payloads and perform lateral movement across systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Wallstreet disables security tools by terminating antivirus processes and modifying system configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Wallstreet encrypts and encodes victim files using symmetric cryptography to ensure data remains inaccessible.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: Wallstreet performs file deletion to remove Volume Shadow Copies and backup artifacts to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Wallstreet executes file and directory discovery to map critical system paths and user data before targeting.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Wallstreet uses network share discovery to locate victim file shares and identify high-value data for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1560.001 Archive via Utility Collection
What they do: Wallstreet archives victim data via utility commands prior to encryption to facilitate potential financial theft.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Wallstreet encrypts victim files using custom ransomware binaries to achieve data encryption for impact.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Wallstreet inhibits system recovery by disabling backup services and altering restore configurations.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Wallstreet performs internal defacement by replacing victim content with ransom notes and contact information.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Victims (44)
Search, filter and paginate the victim timeline for Wallstreet. Showing 1–44 of 44.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Girl Scouts of Eastern Massachusetts id34684 View details | United States | NGOs / Associations | pending | ||
|
Girl Scouts of Eastern Massachusetts Girl Scouts of Eastern Massachusetts, Inc. (GSEMA) is a 501(c)(3) nonprofit serving girls and young people across eastern Massachusetts. Its mission is to help girls build courage, confidence, and character so they can make the world a better place Documents+4 more Published |
||||||
| Ransomware | Girl Scouts of Eastern Massachusetts id34606 View details | United States | NGOs / Associations | pending | ||
|
Girl Scouts of Eastern Massachusetts Girl Scouts of Eastern Massachusetts, Inc. (GSEMA) is a 501(c)(3) nonprofit serving girls and young people across eastern Massachusetts. Its mission is to help girls build courage, confidence, and character so they can make the world a better place DOCUMENTS +4 MORE ENDS IN 23h 40m 52s Girl Scouts of Eastern Massachusetts ✕ ENDS IN 23h 40m 50s DOCUMENTS EMAILS CREDENTIALS PERSONAL DATA MEDIA Girl Scouts of Eastern Massachusetts, Inc. (GSEMA) is a 501(c)(3) nonprofit serving girls and young people across eastern Massachusetts. Its mission is to help girls build courage, confidence, and character so they can make the world a better place |
||||||
| Ransomware | TGM Manufacturing, Inc id34518 View details | United States | Manufacturing / Engineering | pending | ||
|
TGM Manufacturing, Inc TGM Manufacturing provides machining services, including automobile machine-shop work. Documents+3 more Ends in1d 08h 36m 47s |
||||||
| Ransomware | E-Z Pack Trucks id33857 View details | United States | — | — | pending | |
|
E-Z Pack Trucks (E-Z Pack Manufacturing) is a U.S. maker of refuse and recycling truck bodies and related parts. Its product range includes front loaders, rear loaders, and automated or manual side loaders, designed for municipal and commercial waste-collection fleets. The company emphasizes durable equipment, hydraulics, and support for demanding collection routes. Its headquarters are in Cynthiana, Kentucky. |
||||||
| Ransomware | Green Clinic id33858 View details | United States | — | — | pending | |
|
Green Clinic is a community-based healthcare provider serving Ruston and North Central Louisiana. Founded in 1948, it brings primary care, pediatrics, specialty care, pharmacy, laboratory and imaging services together across its clinics https://www.green-clinic.com/assets/news/green-clinic-cybersecurity-update-2026-10-08.pdf |
||||||
| Ransomware | Ahlqvist & Almqvist Arkitekter AB id33824 View details | Sweden | — | — | leaked | |
|
Stockholm architecture and urban-planning practice working on buildings and sustainable city development |
||||||
| Ransomware | Englunds Konsultbyrå AB id33825 View details | Sweden | — | — | leaked | |
|
[AI generated] N/A I don't have reliable, verified information about a company called "Englunds Konsultbyrå AB." While the name suggests a Swedish consulting firm (Sweden, "konsultbyrå" meaning "consulting agency" in Swedish), I cannot confirm its existence, industry focus, services, or operational details from verified sources, and I would not want to fabricate specifics about a business entity. |
||||||
| Ransomware | Spectrum Arkitekter AB id33826 View details | Sweden | — | — | pending | |
|
Stockholm architecture and interior-design firm, with work including commercial properties, workplaces, hotels, property development, and product design. |
||||||
| Ransomware | Vendus Sweden AB id33827 View details | Sweden | — | — | pending | |
|
Swedish property company that acquires, owns, and manages properties, with a focus on grocery-anchored retail real estate |
||||||
| Ransomware | Fab Support AB id33828 View details | Sweden | — | — | pending | |
|
Swedish supplier of electronic components and telecommunications equipment; also provides installation and technical support related to industrial equipment. |
||||||
| Ransomware | Byrån för Arkitektur och Urbanism id33829 View details | Sweden | — | — | pending | |
|
Stockholm architecture firm working in architecture and urban development, including housing, offices, retail, and renovation projects |
||||||
| Ransomware | Briab Group AB id33830 View details | Sweden | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verified information about a specific company called "Briab Group AB." Rather than provide potentially fabricated details about its operations, industry specifics, or founding information, I'm indicating this as unknown to avoid generating inaccurate threat intelligence. If you have source material or additional context about this company, please share it and I can help analyze it. |
||||||
| Ransomware | Danvikshem (Stiftelsen Danviks Hospital) id33831 View details | Sweden | — | — | pending | |
|
A Swedish foundation that operates elder-care services, including residential care at Danvikshem in Nacka |
||||||
| Ransomware | Brunnberg & Forshed Arkitektkontor id33832 View details | Sweden | — | — | pending | |
|
Stockholm architecture practice focused on community buildings and urban development |
||||||
| Ransomware | Mantum Holding AB id33833 View details | Sweden | — | — | pending | |
|
A holding company associated with Mantum, a Swedish transport and logistics group serving construction, recycling, and freight sectors |
||||||
| Ransomware | Lambertinum Seniorenwohnanlage id33834 View details | Germany | — | — | pending | |
|
A nonprofit senior-living facility in Hildesheim, Germany, providing residential nursing care, short-term care, respite care, and assisted living |
||||||
| Ransomware | St. Francis Healthcare Systems of Hawaii id33434 View details | United States | Healthcare / Pharma | — | leaked | |
|
St. Francis Healthcare System of Hawaiʻi is a Catholic, nonprofit healthcare organization that has served Hawaiʻi families since 1927 |
||||||
| Ransomware | World Cup 2034 id33433 View details | Saudi Arabia | — | — | leaked | |
|
We compromised the network of the China Railway Construction Corporation Saudi Branch / Sama Construction consortium, the MAIN CONTRACTOR building the Jeddah Central Stadium for the FIFA World Cup 2034. 17 TB / 1.5M files exfiltrated, including: - Main contract documents, interim payment certificates, and claims against the owner (Jeddah Central Development Company, PIF) - Active dispute and suspension claim records - Personal data of 150,000+ employees, incl. Saudi employees - IFC design documentation for the stadium - Supplier and subcontractor commercial data (bid tabulations) |
||||||
| Ransomware | Tronex A/S id33400 View details | Denmark | IT | — | leaked | |
|
Tronex A/S is a Danish Electronics Manufacturing Services (EMS) company headquartered in Fredensborg, Denmark. Founded in 1988, Tronex provides electronics manufacturing, assembly, testing, procurement, prototyping, and technical production solutions for industrial customers |
||||||
| Ransomware | Gibson Area Hospital & Health Services id33285 View details | United States | Healthcare / Pharma | — | leaked | |
|
Gibson Area Hospital & Health Services is a nonprofit community hospital located in Gibson City, Illinois. It provides a range of healthcare services, including emergency care, inpatient and outpatient treatment, diagnostic testing, rehabilitation, primary care, and services for women and newborns |
||||||
| Ransomware | Tobin & Company id33167 View details | United States | Other | — | leaked | |
|
Tobin & Company, CPA’s is a small accounting firm based in Harrison, New York, providing accounting, tax, auditing, and business consulting services, with a particular focus on nonprofit organizations. |
||||||
| Ransomware | Ar Valve Resources id33168 View details | United Kingdom | Energy | — | leaked | |
|
AR Valve Resources is a UK-based distributor of industrial valves, actuators, regulators, instrumentation, and spare parts. Based in Kent, the company serves national and international customers with product sourcing, technical support, testing, certification, documentation, and shipping services. |
||||||
| Ransomware | GTFM id33169 View details | United States | IT | — | leaked | |
|
GTFM LLC is a company operating through gtfmllc.com. Its website currently provides limited publicly accessible information, so its specific products or services could not be confirmed. |
||||||
| Ransomware | Beatus Cartons id33170 View details | United Kingdom | Manufacturing / Engineering | — | leaked | |
|
Beatus Cartons is a UK-based, privately owned manufacturer of printed folding cartons and packaging. Established in 1940, it produces solidboard, litho-laminated, and plastic packaging for industries including confectionery, pharmaceuticals, food, health and beauty, and automotive. |
||||||
| Ransomware | Breast Implant Center of Hawaii id33175 View details | United States | Healthcare / Pharma | — | leaked | |
|
Breast Implant Center of Hawaii is a plastic surgery and aesthetics clinic serving patients across Hawaii. Based in Kailua-Kona, it offers breast augmentation, implant revision, breast lifts, body contouring. |
||||||
| Ransomware | Prater & Ridley Attorneys At Law id33150 View details | United States | Finance / Legal / Insurance | — | leaked | |
|
Prater, Ridley & Llamas – Attorneys at Law is a law firm based in Temple, Texas, United States. Established in 1993, it provides legal services in family law, criminal defense, probate, estate administration, and related civil matters for clients throughout Central Texas. |
||||||
| Ransomware | Catholic University of El Salvador id33145 View details | El Salvador | Education | — | leaked | |
|
The Catholic University of El Salvador (UNICAES) is a private Catholic university founded in 1982 in Santa Ana, El Salvador. |
||||||
| Ransomware | Odyssey Charter School, Inc. id32902 View details | United States | Education | — | leaked | |
|
Odyssey Charter School, Inc. is a nonprofit organization operating tuition-free public charter schools in Florida for students from preschool through 12th grade, with a focus on academic achievement and whole-child development. |
||||||
| Ransomware | Roshd Sanat id32903 View details | Iran, Islamic Republic of | null | — | leaked | |
|
Roshd Sanat is an Iranian industrial company providing engineering, manufacturing, and technical services, with a focus on industrial and energy-sector projects. |
||||||
| Ransomware | NcbChurch id32733 View details | United States | Other | — | leaked | |
|
New Covenant Believers’ Church is a faith-based ministry focused on spiritual, emotional, and mental growth through God’s Word |
||||||
| Ransomware | On Demand Occupational Medicine id32734 View details | United States | Healthcare / Pharma | — | leaked | |
|
On Demand Occupational Medicine provides occupational health, drug testing, workplace safety, and employee wellness services in Austintown, Ohio. |
||||||
| Ransomware | Goldston Oil Corporation id32735 View details | United States | Energy | — | leaked | |
|
Goldston Oil Corporation is a Houston-based oil and gas exploration and production company operating in Texas and Louisiana |
||||||
| Ransomware | America’s Food Basket id32448 View details | United States | Retail / E-commerce | — | leaked | |
|
America’s Food Basket is a U.S. cooperative grocery-store network. Its site, afbasket.com, provides store locations, weekly ads, online shopping, delivery, recipes, and job listings. It operates under the America’s Food Basket and Ideal Food Basket names. |
||||||
| Ransomware | Ormond Beach Florida id32431 View details | United States | — | — | leaked | |
|
Ormond Beach, Florida, is a scenic coastal city just north of Daytona Beach, known for its beaches, relaxed atmosphere, historic charm, and outdoor activities. |
||||||
| Ransomware | Total Education Solutions id32387 View details | United States | Education | — | deleted | |
|
TES IDEA provides personalized educational, therapeutic, and developmental solutions that help students, families, and schools achieve better outcomes. |
||||||
| Ransomware | Cedar County Memorial Hospital id32337 View details | United States | Healthcare / Pharma | — | leaked | |
|
Cedar County Memorial Hospital is a community hospital providing emergency, inpatient, outpatient, diagnostic, surgical, and rehabilitation services. |
||||||
| Ransomware | Andover id32317 View details | United States | null | — | leaked | |
|
The Town of Andover, Massachusetts, is a municipal government organization that provides public services, administration, community programs, education resources, infrastructure support, and civic information to residents and businesses in Andover. |
||||||
| Ransomware | T.RAD North America id31519 View details | United States | Manufacturing / Engineering | — | leaked | |
|
T.RAD North America (tradna.com) is a Hopkinsville, Kentucky-based manufacturer focused on heat exchangers for thermal-management applications such as vehicle powertrains, HVAC/architectural systems, and emerging technologies like battery and fuel-cell cooling. |
||||||
| Ransomware | Black Hills Bentonite id31520 View details | United States | Manufacturing / Engineering | — | leaked | |
|
Black Hills Bentonite LLC (bhbentonite.com) is a Wyoming-based producer of high-quality sodium bentonite, along with lignite-related products, supplying global industrial and commercial uses such as drilling fluids, environmental/civil engineering sealing, absorbents (including cat litter), and metal casting/foundry applications |
||||||
| Ransomware | Gold Standard Automotive id30256 View details | United States | Transportation / Travel / Logistics | — | pending | |
|
Gold Standard Automotive Network administers vehicle service contracts sold through dealerships, offering coverage for repairs after your factory warranty ends, with claim approvals handled through the company. |
||||||
| Ransomware | Baraga County Memorial Hospital id30257 View details | United States | Healthcare / Pharma | — | leaked | |
|
Baraga County Memorial Hospital is a critical access hospital serving Baraga County with emergency, surgery, imaging, rehab, and outpatient care. |
||||||
| Ransomware | Edgewood Police Department id30254 View details | United States | Public Sector | — | leaked | |
|
The Edgewood Police Department is part of the Pierce County Sheriff’s Department, providing public safety and law enforcement services for the city. |
||||||
| Ransomware | Asisken id30255 View details | Ecuador | Other | — | leaked | |
|
Asisken (asisken.com) is a medical assistance/health insurance company offering prepaid medical coverage and member support services, with a hospital network in Ecuador (and Colombia). |
||||||
| Ransomware | Omax Autos id30040 View details | India | Manufacturing / Engineering | — | leaked | |
|
OMAX Autos Limited is a leading manufacturer of sheet metal components, specializing in the production of auto and non-auto components. |
||||||